CVE-2017-7570: Pivotx

High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days.

PivotX 2.3.11 allows remote authenticated Advanced users to execute arbitrary PHP code by performing an upload with a safe file extension (such as .jpg) and then invoking the duplicate function to change to the .php extension.

Affected products

• Pivotx Pivotx: version 2.3.11 only

Published 2017-04-07. Last modified 2026-06-17.